Skip to content
data-safety-from-codeData safety from code

Is an IP Address Location in the Data Safety Form?

Short answer: if your app, your server or an SDK uses the IP address to work out where the user is, you declare Approximate location. Google says to declare IP addresses based on how you actually use them, and location derived from an IP is approximate, not precise.

What Google says

Section titled “What Google says”

From Google’s Data safety help page:

  • Declare collection, use and sharing of IP addresses based on how you actually use them.
  • If you use an IP address to determine location, declare location.
  • Approximate location is an area of 3 square kilometers or more, and includes location inferred from an IP address. City-level location and Android’s ACCESS_COARSE_LOCATION permission are other examples.
  • Precise location is an area under 3 square kilometers.

Google’s page doesn’t map every other use of an IP address to one data type. If you keep IP addresses for another reason, such as security, read the page and decide based on that use.

Who derives location from IP

Section titled “Who derives location from IP”

Several SDKs do this on your behalf. From this project’s SDK knowledge base, which links each vendor’s own page:

  • AdMob: the IP address may be used to estimate general location. Declared as approximate location, collected and shared.
  • Firebase Analytics: approximate location derived from a masked IP address. Collected, not shared.
  • Firebase Performance Monitoring: collects the IP address to map events to countries. The entry leaves it to you to decide whether to declare approximate location.
  • Mixpanel: recorded as collecting approximate location. That entry is inferred, not from a Play-specific disclosure.

Your own code counts too. A call to an IP geolocation service, or a server that looks up the caller’s country from the request IP, is location collection.

When it can be ephemeral

Section titled “When it can be ephemeral”

If the IP-based location is used only to answer one request, such as picking a regional server, and nothing stores it, you can answer yes to the ephemeral question for approximate location. That only works if no other source, such as an analytics SDK, collects approximate location in a non-ephemeral way. See ephemeral processing.

CSV IDs

Section titled “CSV IDs”
  • PSL_DATA_TYPES_LOCATION with PSL_APPROX_LOCATION: the data type.
  • PSL_PRECISE_LOCATION: only for GPS-level location, not for IP.
  • Usage rows for the type start with PSL_DATA_USAGE_RESPONSES:PSL_APPROX_LOCATION:, for example PSL_DATA_USAGE_ONLY_COLLECTED, PSL_DATA_USAGE_ONLY_SHARED, the ephemeral row, and purposes such as PSL_ANALYTICS, PSL_ADVERTISING or PSL_FRAUD_PREVENTION_SECURITY.

Common mistakes

Section titled “Common mistakes”
  • No location declared because the app has no location permission. IP-based location needs no permission.
  • Declaring precise location for IP lookups. IP-based location is approximate.
  • Missing the SDK case. Ads and analytics SDKs can derive location from the IP address even if your code never does.
  • Marking it shared for a service provider. Firebase Analytics is collected, not shared; an ad network like AdMob is both.

With data-safety-from-code

Section titled “With data-safety-from-code”

The skill adds approximate location automatically when an SDK’s disclosure lists it, with the vendor page as evidence. It also flags calls to common IP geolocation services in your source, such as ipinfo.io or ip-api.com, so the agent can check the code and declare approximate location where it applies. Get started.

Section titled “Related”

Want the form filled from your own code, with evidence? Install the skill. If this page helped,star the repo on GitHub.

Built by Sanikant. Set in Google Sans Flex (SIL Open Font License), icons from Material Symbols (Apache 2.0). Google Play is a trademark of Google LLC; this project is not affiliated with Google. Output is a draft for review: you are responsible for your Data safety declaration.